MoneyGram says hacker stole customers' personal information and transaction data
techcrunch.com
techcrunch.com
> MoneyGram said the types of stolen data will vary by individual. MoneyGram said that the stolen data also included transaction information, such as dates and amounts of transactions, and, “for a limited number of consumers, criminal investigation information (such as fraud).”
What is this "limited number" weasel word crap? This conveys no information. What's the limit, then? "Limited" could mean anything. It could be "limited" to 100 million for all anyone knows. Why not say the actual number or order of magnitude? It must be damning...
“Show me the incentives and I’ll show you the outcome.”
Regulation is usually the answer. More? Better. It ain't gonna regulate itself. Storing and processing data securely is not hard. It is work though. Breaches happen because systems and corporations don't care [3], they aren't exposed to the cost of data loss, as there is none.
Would you prefer the business not store the data, but the government attests to your identity (as part of a proofing request and flow) and also stores the receipt and AML/KYC metadata? There are legal and compliance requirements in the finance space unfortunately, and those are not going away. If identity is a requirement, a system must attest to it, and logs of some type must be created to document the ceremony.
[1] https://en.wikipedia.org/wiki/Tokenization_(data_security)
Breaches only happen because corporations "don't care"? I guess the US government doesn't care, then?
Event Description Date Agency Number of People Affected -------------------------------------------------------------------------------------------------------------------------
SolarWinds Cyberattack December 2020 Multiple federal agencies Approximately 18,000
U.S. Office of Personnel Management (OPM) Breach June 2015 Office of Personnel Management 21.5 million
U.S. Department of Veterans Affairs Breach May 2006 Department of Veterans Affairs 26.5 million
Georgia Secretary of State Office Breach November 2015 Georgia Secretary of State 6.2 million
Virginia Department of Health Professions Breach May 2009 Virginia Department of Health 8.3 million
Texas Attorney General Office Breach April 2012 Texas Attorney General 6.5 million
Department of Transportation Data Breach May 12, 2023 Department of Transportation 237,000
National Public Data Breach (reported) August 2024 National Public Data Nearly 3 billion
Edit: Your examples are outliers, based on the data, and those costs are not brand and reputational, they are settlements or fines (which are rare). If you want to move goal posts, that's a choice. No one is going to stop using Equifax for consumer reporting data or Target because of their cybersecurity posture (ie brand and reputation damage).
https://www.ibm.com/reports/data-breach
https://www.vox.com/the-goods/23031858/data-breach-data-loss...
https://www.idtheftcenter.org/post/itrc-sees-third-most-data...
Heartland Payment Systems - Although the company did not go out of business, it suffered significant financial losses from a major breach in 2008, leading to over $110 million in settlements and fines. This incident severely damaged its reputation and operational capacity.
Target - The retail giant faced a massive data breach in 2013, which compromised approximately 40 million credit and debit card accounts. While Target did not go out of business, the breach led to substantial financial losses, including a $18.5 million settlement with state attorneys general.
Equifax - The credit reporting agency experienced a breach in 2017 that exposed sensitive information of about 147 million people. Although Equifax remains operational, the breach resulted in over $700 million in settlements and significant reputational damage.
MySpace - While MySpace did not directly go out of business due to its data breach in 2016 (which affected 360 million accounts), it lost significant market share and relevance, ultimately leading to its decline as a social media platform.
FriendFinder Networks - This adult entertainment company faced a severe breach in 2016, affecting 412 million accounts. While it has not officially declared bankruptcy, the breach contributed to its ongoing struggles in a competitive market.
Ashley Madison - The dating site for extramarital affairs suffered a data breach in 2015 that exposed the personal information of millions of users. The fallout from this breach led to lawsuits and significant reputational damage, severely impacting its business operations.
NortonLifeLock (formerly Symantec) - Following a series of breaches and security issues, the company faced declining revenues and market share, leading to a significant restructuring and changes in business focus.
A $18.5m fine for a company with around $25b in quarterly revenue.
> Equifax - The credit reporting agency experienced a breach in 2017 that exposed sensitive information of about 147 million people. Although Equifax remains operational, the breach resulted in over $700 million in settlements and significant reputational damage.
Yeah, take a look at Equifax's financials. It has done nothing but go from strength to strength since 2017, and the financial impact of that incident is nothing more than a speed bump.
Equifax has more than doubled its market cap, grown its revenue by over 60% and has remained extremely profitable at all times since then.
Anyone who bought Equifax stock in late 2017 has done very well.
https://www.irs.gov/identity-theft-fraud-scams/get-an-identi...
It's not a fix but a band-aid so at least people can't file taxes with your SSN.
This policy will remain outside the Overton Window until several more digital Pearl Harbors like the one that just happened in Lebanon, where Israel was able to leverage its surveillance of Hizbullah members into an almost total annihilation of Hizbullah as an organization. Many other armed forces around the world are going to experience the same thing over the next decade, because it's far too late for soldiers' and politicians' family members to avoid ever signing up for Facebook, Zelle, PayPal, MoneyGram, etc.
I don't know what the landing looks like, but before we get there, this flight may experience some turbulence.
Personal opinion: that's a pipe dream and it's never going to happen. Moving money is an extremely vital part of modern economies, and importantly, of underground ones.
You mention Hizbollah - without KYC they would have been able to more easily receive donations from sympathisers and use those funds to buy stuff from everywhere. Their surveillance by Israeili services wasn't online surveillance, because the group has already been burned by advanced Israeli cybersecurity attacks. They were using pagers ffs, do you really think their members were tracked and surveilled online?
And the same would apply for stuff like criminal regimes evading sanctions even more, cartels laundering their money, financial scams like Wirecard proliferating even more.
Look at the crypto space that promised to change that - outside of the absurd lack of practicality, it led to millions of scams, money laundering operations, North Korea abusing it to fund itself, and the like.
No. They should not be permitted to retain and/or sell that information.
Out of curiosity, why do you think we have KYC laws in the first place?
Give me the ability to generate a signed certificate that says "hakfoo is not currently denylisted for financial crimes" and let me submit it as part of account onboarding. Maybe include some new, non-SSN, low-stakes identifier so I can't make forty different certificates and pretend to be forty people.
Such an agency can be more privacy forward than any private player: there's no financial motivation for them to be "sharing data with our partners and affiliates", and is structurally disinterested in expanding its reach into other data-grab products (looking at you, credit reporting services).
If the banks and such really have to do some sort of data-derived KYC-theatre-- looking for structuring and spurious patterns-- it could still be done with minimal personal data-- tracking the accounts by UUIDs.
See Stuxnet for one such example—it wasn't related to privacy, but it seems unlikely that the Iran's National Organization For Civil Registration is any better able to prevent foreign penetration of its systems than its nuclear energy agency was, so presumably the Mossad has a complete and up-to-date copy of its national identity database. Such information seems likely to be very valuable in circumstances such as the assassination of Ismail Haniyeh and the next few months of open war between Israel and Iran.
There might be a new record of inquiries or certificates generated, perhaps, but that doesn't really need to be logged.
Identity is always an ugly technical problem, and IMO the federal option has the least ugliness. Yeah, you have one database, but that also means you have only one place to monitor, keep up to date with state-of-the-art security norms, and one giant legal hammer to go after anyone who breaches it.
* Devolving the problem to lower-level governments just means you replace one database with dozens, and get to deal with varying security and use paradigms, and interoperability and data synch that's clumsy at best. How long can you keep a scam running using Jane Doe in Idaho's credentials until the system is synched and learns she actually moved to West Virginia?
* Using private entities to manage it would have all the worst incentives for misuse and abuse, and either gives one bid-winner the keys to the economy or creates a bunch of fiefdoms incentivized to limit interoperability.
* Any sort of bottom-up "self-attestation" or web-of-trust sort of solution would be difficult to bootstrap and require generating mountains of new legal precedent and tooling to support.
Any company that accesses/uses Personally Identifiable Information (PII) must register a “PII Czar” with the proper authorities. That person (or persons, depending on the size/scope of the PII data) can be held criminally liable in the event of a data breach.
If a jury finds that the PII Czar enacted the correct policies/procedures & took the right precautions, a jury could find them innocent. But if there was willful or negligent handling at the company, the PII Czar goes to jail.
In the US, one of the big lies told at the corporate level is that no one ever sees jail time because the regulators are too underfunded in comparison with large companies. What’s necessary is clear personal ownership of PII and criminal liability in the event of a data breach.
"What chairman?" Bender exclaimed.
"An official one - in a word, the chief of the establishment."
"I am the chief myself."
"In other words, you expect to do time yourself? Why didn't you say so in the first place? Why did you take up two hours of my valuable time?"
The old man in the Passover trousers became exceedingly angry, foamed at the mouth, fumed, emitted explosive noises, but the pauses between his sentences did not diminish.
"I am Funt!" he said emphatically. "I am ninety years old! All my life I've done time for others! Such is my profession - to suffer for others!"
"Oh, so you're professional figure-head!"
"Yes," said the old man, tossing his head boastfully. "I am Substitute-chairman Funt! I've always done time. At the time of Alexander the Second, the Liberator, at the time of Alexander the Third, the Peacemaker, at the time of Nicholas the Second, the Bloody." And the old man slowly bent back his fingers, counting the tsars. "At the time of Kerensky I also did time. At the time of Military Communism, I did no time, to tell the truth, because clean business disappeared and there was no work for me. But how I did time in the days of the NEP! How I did time in the days of the NEP! Those were the best days of my life..."
Ilya Ilf and Eugene Petrov, The little golden calf. https://archive.org/details/littlegoldencalf0000unse
Data Fiduciary Duty - you have to use the data you have in the best interest of your client (which isn't allowed to be the advertisers that want the data, nope!), and if that means deleting what isn't necessary, so much the better.
Also, forced arbitration isn't allowed and class action lawsuits result in more than a reward of $3.97 paid five years later with a free year of credit monitoring thrown in.